W3 Total Cache (< 2.7.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/w3-total-cache--2.7.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 15:00:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBoldgrid W3 Total Cache Cleartext Credential Storage (CVE-2023-5359)https://feed.craftedsignal.io/briefs/2026-10-w3-total-cache-exposure/Thu, 22 Oct 2026 15:00:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-w3-total-cache-exposure/CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.CVE-2023-5359 affects the WordPress plugin W3 Total Cache (versions ≤ 2.7.5). The plugin stores sensitive configuration and API credentials in plain text within PHP files located in the /wp-content/plugins/w3-total-cache/ directory. Due to insufficient access control, these files are directly accessible via standard HTTP GET requests, leading to the exposure of CloudFlare API keys, client secrets, and other third-party service credentials.

Impact

Successful exploitation allows unauthenticated remote attackers to obtain sensitive credentials. This may result in the takeover of associated services (e.g., CloudFlare DNS and CDN management), unauthorized access to external service accounts via compromised OAuth tokens, and potential manipulation of cached website content.

Recommendation

  • Update the W3 Total Cache plugin to version 2.7.6 or later immediately.
  • Revoke and regenerate all API keys, OAuth tokens, and client secrets associated with the affected WordPress installation.
  • Implement access restrictions in the web server configuration (e.g., .htaccess for Apache) to deny direct access to PHP files within the plugin directory, while explicitly allowing access only to required entry points like 'w3-total-cache.php'.
  • Conduct an audit of logs for unauthorized HTTP GET requests directed at the /wp-content/plugins/w3-total-cache/ path to determine if exploitation has occurred.
]]>highadvisorywordpressvulnerabilitycredential-exposureweb-application